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FD-302 (Rey. 5-8-10) KIODA 


UNCLASSIFIED//FesSe- 


FEDERAL BUREAU OF INVESTIGATION 
Date of entry 04/11/2017 


[ 1 ввотЕСТ IDENTITY), date of birth (ров) 


b6 
ъ7с 
b"7D 


After being advised of the identity of the interviewing Agents and the 
nature of the ite Ta LLL provided the following 
information: 


b6 
b7C 
b7D 


bé 
b7C 
b7D 


bé 
b7C 
b7D 


b6 
b7C 
b7D 


UNCLASSIFIED//PFese- 


File ë Date dratted 04/04/2017 b6 
en: bic 


v | ътр 


Ъ7Е 


This document contains neither recommendations nor conclusions of the FBI, It is the property of the FBI and is loaned to your agency: it and its contents are not 
10 bc distributed outside your agency. 
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288A-NK-2158180 Serial 1 


FD-71 (Rev. 5-8-10) 
UNCLASSIFIED 
FEDERAL BUREAU OF INVESTIGATION 
Complaint Form 
Title: (U) COMPUTER INTRUSION Complaint by Date: 04/19/2017 


Case ID d: 288A-NK-2158180 (U) JOHN MCAFEE; 
- VICTIM; 
COMPUTER INTRUSION - CRIMINAL 


Complaint Synopsis:  (U) Computer Intrusion and email compromise 
complaint made by Complainant believed John 
McAfee was behind the intrusion 


Preliminary Investigation Initiated: 04/19/2017, set to expire 10/19 
/2017 


Enclosure(s): Enclosed are the following items: 
1. (U) Interview notes 


Received On: 03/29/2017 
Receipt Method: In Person 
Incident Type: Criminal Activity 


Complaint Details: 


On 03/29/2017, at 10:20 a.m. Eastern Tim,[ — —  ] 


date of birth driver's license number 


of the Newark Field Office of the Federal Bureau of 


Investigation to file a complaint regarding an alleged computer 
intrusion and email account compromise. 


[provides the following information. 


UNCLASSIFIED 


bé 
b7C 


b6 
ъ7с 


b6 
ъ7с 


288A-NK-2158180 Serial 1 


UNCLASSIFIED 
Title: (0) COMPUTER INTRUSION Complaint w[ 1] be 
Ве: 288A-NK-2158180, 04/19/2017 PIE 


b6 
b7C 
John McAfee (Reference, Person, U.S. Person? Unknown) 
Name/Biographical Information 

Name: John McAfee 

Minor? No 

Citizenship: 

Languages: 

Public Figures: 

Caution Statements: 

Has Diplomatic Status? No 
b6 
b"7C 


UNCLASSIFIED 


4 


288A-NK-2158180 Serial 1 


UNCLASSIFIED 


Title: (0) COMPUTER INTRUSION Complaint b |] bé 


Ве: 288A-NK-2158180, 04/19/2017 PUE 


b6 
b7C 


** 


UNCLASSIFIED 


5 


288A-NK-2158180 Serial 2 


FD-1057 (Rev. 5-8-10) 
UNCLASSIFIED 


FEDERAL BUREAU OF INVESTIGATION 


Electronic Communication 


Title: (U) Late Entry to Evidence Control Date: 05/03/2017 


ce: 
b6 
ъ7с 
From: NEWARK 


b6 
Approved : Тс 
DP: By b7E 
Drafted By: 
Case ID #: 288A-NK-2158180 (U) JOHN MCAFEE; 
- VICTIM; 56 
COMPUTER INTRUSION - CRIMINAL bre 
Synopsis:  (U) Derivative evidence submitted to Evidence Control 


Center beyond ten days after acquiring. 


Preliminary Investigation Initiated: 04/19/2017, set to expire 10/19 
/2017 


Details: 

Derivative evidence from a laptop computer, a cell phone, and tablet 

Guides beum col 7 fepe атыс аталы bs 
c 

Newark's Evidence Control Center, more than ten days after acquiring 


of evidence. The derivative evidence was being maintained for review 


and further analysis which caused the late submission. 


+ 


UNCLASSIFIED 


288A-NK-2158180 Serial 3 


FD-1087 (Rev. 5-8-10) 
UNCLASSIFIED 


FEDERAL BUREAU OF INVESTIGATION 


Collected Item Log 


Event Title: (U) FORENSIC IMAGE OF LAPTOP Date: 05/03/2017 
COMPUTER 
Approved $ b6 
PP: By en 
Drafted By: 
Case ID 4: 288A-NK-2158180 (U) JOHN MCAFEE; 
- VICTIM; b6 
COMPUTER INTRUSION - CRIMINAL bic 


Preliminary Investigation Initiated: 04/19/2017, set to expire 10/19 
/2017 


b7C 
Receipt Given?: No 
Holding Office: NEWARK 
Details: No Details Provided 


Item Type Description 
1B Digital (U) ONE (1) 
"DENKO1”, 


HARD DRIVE LABELED 


CONTAINS FORENSIC IMAGE 
EO1" OF LAPTOP: APPLE MACBOOK PRO, SERIAL: 


CNKOT | 


Collected On: 04/19/2017 06:00 PM EDT 
Seizing Individua 
Collected By: 


Location Area: N/A D 
Specific Location: N/A bIE 
Device Type: Hard Drive 

Make: 

Model: 


Serial Number: 
Number of Devices Collected: 1 


UNCLASSIFIED 


This document contains neither recommendations nor conclusions of the FBI. it is the property of the FBI and is loaned to your agency: it and its 
contents are not to be distributed outside your agency. 


288A-NK-2158180 Serial 3 


UNCLASSIFIED 


Title: (U) FORENSIC IMAGE OF LAPTOP COMPUTER 
Re: 288A-NK-2158180, 05/03/2017 


+ 


UNCLASSIFIED 


2 


288A-NK-2158180 Serial 4 


FD-1087 (Rev. 5-8-10) 
UNCLASSIFIED 


FEDERAL BUREAU OF INVESTIGATION 


Collected Item Log 


Event Title: (U) DATA EXTRACTION OF CELL PHONE Date: 05/03/2017 
DEVICE 
b6 
Approved Н 
PP: By Bae 
Drafted By: 
Case ID #: 288A-NK-2158180 (U) JOHN MCAFEE; 
- VICTIM; b6 
COMPUTER INTRUSION - CRIMINAL bic 


Preliminary Investigation Initiated: 04/19/2017, set to expire 10/19 
/2017 


ьлс 


Receipt Given?: No 


Holding Office: NEWARK 


Details: No Details Provided 

Item Type Description 

1B Digital U) ONE (1) BLU-RAY DISC LABELED "DENKO2." CONTAINS 
DATA EXTRACTIONS AND GENERATED REPORTS OF 


CELL PHONE DEVICE: APPLE IPHONE 6, SERIAL: 

Collected On: 04/20/2017 03:40 PM EDT erm 
Seizing Individual: BIE 
Collected By: 

Location Area: N/A 

Specific Location: N/A 

Device Type: Blu-Ray Disc 

Number of Devices Collected: 1 


++ 


UNCLASSIFIED 


This document contains neither recommendations nor conclusions of the FBI. it is the property of the FBI and is loaned to your agency: it and its 
contents are not to be distributed outside your agency. 


288A-NK-2158180 Serial 5 


FD-1087 (Rev. 5-8-10) 
UNCLASSIFIED 


FEDERAL BUREAU OF INVESTIGATION 


Collected Item Log 


Event Title: (U) DATA EXTRACTION OF TABLET Date: 05/03/2017 
DEVICE 
Approved By ь6 
b7C 
Drafted By: 
Case ID #: 288A-NK-2158180 (U) JOHN MCAFEE; 
- VICTIM; b6 
COMPUTER INTRUSION - CRIMINAL b7C 


Preliminary Investigation Initiated: 04/19/2017, set to expire 10/19 
/2017 


b7C 


Receipt Given?: No 


Holding Office: NEWARK 


Details: No Details Provided 

Item Type Description 

1B Digital U) ONE (1) BLU-RAY DISC LABELED "DENKO3." CONTAINS 
DATA EXTRACTIONS AND GENERATED REPORT OF 


TABLET DEVICE: APPLE IPAD 3RD GENERATION, MODEL: 

Collected On: 04/21/2017 10:00 AM EDT erm 
Seizing Individual: BIE 
Collected By: 
Location Area: N/A 
Specific Location: N/A 
Device Type: Blu-Ray Disc 


Number of Devices Collected: 1 
++ 
UNCLASSIFIED 
This document contains neither recommendations nor conclusions of the FBI. it is the property of the FBI and is loaned to your agency: it and its 


contents arc not to be distributed outside your agency. 


288A-NK-2158180 Serial 6 


-1 of 1- 


FD-302 (Rey. 5-8-10) 


FEDERAL BUREAU OF INVESTIGATION 


Date of entry 05/04/2017 
On 04/19/2017, Special Agent (SA) С ]regsestea Computer b6 
Scientist (CS) forensically image one laptop computer in BIC 
support of case 288A-NK-2158180. 
оп 04/19/2017, cs[ ]conducted forensic imaging of the following bé 
item: BIC 
Make | Model Serial Type 
Apple | Macbook Pro Laptop b6 
b7C 
The laptop computer contained the following hard drive: 
Make | Model Serial Size Type 
Hitachi HTS545032B9SA02 BEI: | SATA b6 
b7c 
The hard drive was imaged to the following forensically clean hard drive: 
Wake Type 
b7E 


All administrative documents are being placed in a 1A envelope for 
retention in the FBI Newark Division file. 


investigationon 04/19/2017 a Newark, New Jersey, United States (In Person) 


me, 2882-21581] Datedrated 05/04/2017 b6 
by ЪТЕ 
This document contains neither recommendations nor conclusions of the FBI. tt is the property of the FBI and is loaned to your agency: it and its contents ate not 

10 be distributed outside your agency. 


CONSENT TO SEARCH COMPUTER(S) 


` b6 
1, Ваа НЕС ИБ have been asked by Special Agents of the ътс 


Federal Bureau of Investigation (FBI) to permit a complete search by the FBI or its designees of any and all computers, 
any electronic and/or optical data storage and/or retrieval system or medium, and any related computer peripherals, 


described below: 


1 -Macbook Pr& sn. | with ma д сс“ Ps 


CPU Make, Model & Serial Number (if available) 


Storage or Retrieval Media, Computer Peripherals 


and located al which I ọwn, possess, 
bé 


control, and/or have access to, for any evidence of a crime or other violation of the law. The required passwords, logins, b7C 


and/or specific directions for computer entry are as follows: — $^ TU сео =] 


Thave been advised of my right to refuse to consent to this search, and J give permission for this search, freely 


and voluntarily, and not as the result of threats or promises of any kind. 


I authorize those Agents to take any evidence discovered during this search, together with the medium in/on which 


b6 


it is stored, and any associated data, hardware, software and сопу ътс 


288A-NK-2158180 Serial 7 


FD-302 (Rey. 5-8-10) -1 of 2- 


FEDERAL BUREAU OF INVESTIGATION 


Date of entry 05/04/2017 


REPORT OF DExT ANALYSIS 


Included herein are the results of a digital forensic archive and analysis 
performed in accordance with FBI Digital Extraction Technician (DExT bé 


policies and procedures) by ш] pic 


Request: Case agent, Special Agent[  — S 1] requested that all 


digital content be extracted from the submitted specimens for case agent b6 
review. b7C 


Summary of Results: 


b6 
b7c 
b7E 

investigationon 04/19/2017 m Newark, New Jersey, United States (In Person) 
me, 288A-NK-2158190, [Dll l C Daedumed 05/04/2017 ъв 
bic 


by b7E 


This document contains neither recommendations nor conclusions of the FBI, It is the property of the FBI and is loaned to your agency: it and its contents arc not 
10 bc distributed outside your agency. 


CONSENT TO SEARCH COMPUTER(S) 


bé 


have been asked by Special Agents of the BIC 
ation (FBE to permit a complete search by ihe FB! or its designees of any and all computers, 
any electronic and/or optical data storage andor retrieval system or medium, and any related computer peripherals. 
bé 
š i ч 322 
bis E Бкығал ё ig Y ў ътс 
bé 
which own. possess. b7C 


control, andor have access to, for any evidence of a crime or other violation of the law. ‘The required passwords, logins, 
тайға specific directions for computer entry are as follows: 15 i 
} have been advised of my бен to refuse to consent to this search, and š nive permission for this search. freely 


and voluntarily, and notas the result of threats or promises of any kind. 


bauthoriae those Agents tu take any evidence discovered during this search, together with the medium inco which 
has Stored, and any 


jated data, hardware, software and co} 


b6 
ъ7с 


CONSENT TO SEARCH COMPUTER(S) 


b6 
‚have been asked by Special Agents ci the b7c 
ation (FBU to permit a complete search by the FBI or its designees of any and all computer: 
or optical data storage and-or retrieval system or medium. and any related computer peripherals 
bé 
К f ik ъ7с 
Pi v Seral Sumber (if available 
al Media, Computer Peripherals 
bé 
and зшде ai Rich | own, possess, BIC 
andr have access to, for any evidence of a crime or other violation of the law. The required passwords. logins, 
e specific direction computer entry are as follows: 
i have been advised ef my right to refuse to consent to this search, and Í give permission for this search, freely 
aud veluntariiy. and not as the result Gf threats or promises of any kind. 
Vauhorize those Agents iy take any evidence discovered during this search. together with the medium ілген whi 
stored, and any associated data, hardware. software and computer peripherals. 
zT т bé 
Signature of Witness. ътс 


288A-NK-2158180 Serial 8 


FD-1036 (Rev. 10-16-2009) 
UNCLASSIFIED 
FEDERAL BUREAU OF INVESTIGATION 
Import Form 
Form Type: OTHER Date: 05/08/2017 


Title:(U) VNS Letter/Initial 
рр: By nae 


Case ID #: 288A-NK-2158180 (U) JOHN MCAFEE; 
- VICTIM; b6 
COMPUTER INTRUSION - CRIMINAL BIC 
Synopsis: (9) Initial Victim Notification Letter 
++ 


UNCLASSIFIED 


288A-NK-2158180 Serial 9 


FD-1057 (Rev. 5-8-10) 
UNCLASSIFIED 


FEDERAL BUREAU OF INVESTIGATION 


Electronic Communication 


Title: (U) Destruction Of Derivative Evidence Date: 09/07/2017 
Items For Captioned Investigation 


сс: bé 
b7c 


From: NEWARK 


b6 
Approved By: SSA b?7c 


b7E 
Case ID #: 288A-NK-2158180 (U) JOHN MCAFEE; 
- VICTIM; b6 
COMPUTER INTRUSION - CRIMINAL b7c 
Synopsis: (U) To document the destruction of derivative evidence for 


captioned case: 1Bl, 1B2, and 1B3. 


Preliminary Investigation Initiated: 04/19/2017, set to expire 10/19 
/2017 


Details: 


Writer is requesting FBI Newark Computer scientiste[____ |] ь6 


2 а А ^ Tr ъ7с 
to destroy the following derivative evidence items for the captioned 


investigation: 

1B1 (E5257512) - FORENSIC IMAGE OF LAPTOP COMPUTER 
1B2 (Е5257511) - DATA EXTRACTION OF CELL PHONE DEVICE 
1B3 (E5257510) - DATA EXTRACTION OF TABLET DEVICE 


Thereafter, writer is requesting the status be update as destroyed for 
final disposition. 


UNCLASSIFIED 


288A-NK-2158180 Serial 9 


UNCLASSIFIED 


Title: (U) Destruction Of Derivative Evidence Items For Captioned 
Investigation 
Re: 288A-NK-2158180, 09/07/2017 


+ 


UNCLASSIFIED 


2 


288A-NK-2 158180 Serial 10 


FD-1036 (Rev. 10-16-2009) 
UNCLASSIFIED 
FEDERAL BUREAU OF INVESTIGATION 
Import Form 
Form Type: OTHER Date: 09/26/2017 


Title:(U) FD-1087s, 1B1, 1B2, 1B3 - destroyed evidence 


Approved By: 


b6 

Drafted By: ъ7е 
Case ID #: 288A-NK-2158180 U) JOHN MCAFEE; 

- VICTIM; b6 

COMPUTER INTRUSION - CRIMINAL Bae 


Synopsis: (0) FD-1087s, ІВІ, 1B2, 1B3 - destroyed evidence 


Enclosure(s): Enclosed are the following items: 
1. (U) FD-1087s, 1B1, 1B2, 1B3 - destroyed evidence 


+ 


UNCLASSIFIED 


of 3 


| БЛЕ 


Evidence Details 


Case; | 288A-NK-2158180 Мет: 1Bl 


Description: (0) ONE (1 HARD DRIVE LABELED "DENK01", 
[CONTAINS FORENSIC 
IMAGE "ОМКО1 01.501" OF LAPTOP: APPLE MACBOOK PRO, SERIAL: 


Collected Оп: 04/19/2017 06:00 PM EST 


Receipt item й: None Special Handling: None 
CATS Юй: None Hazardous Materials: None 

FBI Selzure #: None 
CATS Abandonment None Abandonment #: None 


* 
Late Justification; (0) SEE LATE ЕС РВОМ cs — — — —] 


Digital Information 


Hard Drive 


F] 
Number Collected: 1 
Collected by CART: No 


Discovery Location 
Area: N/A Others: None 
Specific: N/A Others Agency: 
Seizing individu: Е Collected By: 


Selzing Individu: lone 
‘Othe: 


Anticipated Disposition 
None on None 


‘Storage Information 
Holding Office: NEWARK 


ОО Last Inventory: None 


Location: 03370623 - ECR 
E02123281 - ECR, CART, CART ROOM 
502123326 - ECR, CART, S45 


Barcode #: 25257510 
Chain of Custody 
‘Shipping / Transfer Log 
History 


‘Acquisition Event Details 
Acquisition Event: (U) FORENSIC IMAGE OF LAPTOP COMPUTER 


CAGE 
Receipt Given: No OD 


Holding Office: NEWARK 


Evidence Log: 288A-NK-2158180 
Serial 3 


b6 
ъ7с 
ЪТЕ 


b6 
b7C 


b7E 


b6 
ътс 


bé 
ьтс 


b6 
b7C 


5/3/2017 4:35 PM 


b7E 
тілей Working Copy 


Evidence Details 


с 288A-NK-2158180 item: 152 
Description: (U) ONE (1) BLU-RAY DISC LABELED "Ренко." contains L Joata be 
EXTRACTIONS AND GENERATED REPORTS OF CEL EVICE: APPLE IPHONE PC 
6, seems Ld ner — | BIE 
Collected Оп: 04/20/2017 03:40 PM EST 
Receipt item #: None Special Handling: None 
CATSID#: None Hazardous Materials: None 
FBI Seizure #: None 
CATS Abandonment None Abandonment#: None 
Е 


Late Justification: (U) SEE LATE EC FROM [| b6 
ъ7с 


Digital Information 


Type: Blu-Ray Disc 
Batteries Charged: No 

Number Collected; 1 

Collected by CART: No 


Discovery Location 
Area; N/A Others: None 
Specific: N/A Others Agency: None 


Seizing Individual None b7C 
Other: 


Anticipated Disposition Н 
None on None i 


: Storage Information 
à Holding Office: NEWARK 


Finatized By: [— — j Last Inventory: None be 


b7C 
Location: 503370623 - ECR 
802123281 ~ ECR, CART, CART ROOM 
E02123326 - ECR, CART, S45 

Barcode #: E5257511 
Chain of Custody 
‘Shipping / Transfer Log 
History 


Acquisition Event Details " 
Acquisition Event: (U) DATA EXTRACTION OF CELL PHONE DEVICE i: 


тенен of 123 b? 
— ; 
por 


f ъ7с 
Receipt Given: No 


Holding Office: 


Evidence Log: 


20f3 5/3/2017 4:35 PM 


entinel Working Copy 


Evidence Details 


Case: | 2B88A-NK-2158180 Hem: 283 
Description: (U) ONE (1) BLU-RAY DISC LABELED "DENKO3." CONTAIN: DATA b6 
EXTRACTIONS AND GENERATED REPO! CE: APPLE IPAD 3RD ъ7с 
БЛЕ 
Collected Оп: 04/21/2017 10:00 AM EST 
Recetpt item #: None Special Handling: None 
CATSIDK None Hazardous Materials: None 
FBI Seizure #: None 
CATS Abandonment None Abandonment #: None 
ж 
Late Justification: (0) SEE LATE EC FROM e |] b6 
b7C 
Digital Information 
Type: Blu-Ray Disc 
Batteries Charged: No 
NumberCollected: 1 
Collected by CART: No 
Discovery Location 
3 Others: None 
ifie: N/A Others Agency: None 
ssa wai: coman | ъв 
Seizing individual "7C 
Other: x 
Anticipated Disposition 
None on None 
‘Storage Information 
Holding Office: NEWARK 
ъ7с 


Location: 503370623 - ECR 
E02123281 - ECR, CART, CART ROOM 
E02123326 - ECR, CART, S45 
Barcode #: E5257512 
‘Chain of Custody 
Shipping / Transfer Log 
History 


Acquisition Event Details 


Acquisition Event: (U) DATA EXTRACTION OF TABLET DEVICE 


prc M Ip = =~ Саш 


Receipt Given: No 


Holding Office: 


Evidence Log: 


Serial 5 


of 3 


GE cory b6 


E КА? ътс 


5/3/2017 4:35 РМ 


FD-1004 FEDERAL BUREAU OF INVESTIGATION 


Rev. 7-7-2016 
EVIDENCE CHAIN OF CUSTODY 
Evidence Type: Г] General Г] Drugs TO Firearms/Weapon | tem # 
У} Digital [Г Valuabies TO Firearms/Other 
Special Handling Instructions Initial Receipt Date and 
Time 
П HAZMAT LT Latents П FG; Signature of Seizing Individu: 4/21/2017 
Ü Req. Charging CI Freeze Refrigerate 10:00 am 
C Biohazard b6 
L1 Other b7C 
Relinquished Custody Date and 
Time 
Signature: 
SST] se 
қ b7C 
Reason: Ze Otro Fo ECS 10:46 ay 
Relinquished Custody Date and | Accepted Custod Date and 
Time 
‹ 7) ‚7 
>” b6 
L> 26? | тс 
Date and 
Time 
Signature: 
КА 7 /] | Printed Namc/Agency: b6 
b7c 


еле — 
Relinquished Custody Date and 
Time 
Signature: Signature: 
Printed Name/Agency: Printed Name/Agency: 
Reason: | Reason: 
Relinquished Custody Date and | Accepted Custody Date and 
Time Time 
Signature: | | Signature: 
Printed Name/Agency: | Printed Name/Agency: 
Reason: Reason: 
Relinquished Custody Date and | Accepted Custody Date and 
Time Time 
Signature: Signature: 
Printed Name/Agency: | Printed Name/Agency: 
Reason: | Reason: 


Firearm Certification by (FUSWAT) / Explosive Material Certification by (SABT): 


Printed Name: 


ATF Trace Form Completed: [_] 


NCIC: 


Signature: 


Date: 


Case ID: 288A-NK-2158180 _ 18: 3 Barcode: Е 525 +57. 


This form is incomplete without reference to the FD-1087. 


EVIDENCE CHAIN OF CUSTODY 


Relinquished Custody Date and | Accepted Custody Date and 
Time Time 
Signature: Signature: 
Printed Name/Agency: Printed Name/Agency: 
Reason: Reason: 
Relinquished Custody Date and | Accepted Custody Date and 
Time Time 
Signature: [ Signature: 
Printed Name/Agency: 1 | Printed Name/Agency: 
Reason: L Reason: 
Refinquished Custody Date and | Accepted Custody Date and 
Time Time 
Signature: Signature: 
Printed Name/Agency: | Printed Name/Agency: 
Reason: | | Reason: 
Relinquished Custody Date and | Accepted Custody Date and 
Time Time 
Signature: Signature: 
Printed Name/Agency: | Printed Name/Agency: 
Reason: Reason: 
Relinquished Custody Accepted Custody Date and 
Time Time 
Signature: Signature: 
Printed Name/Agency: ШЕ Printed Name/Agency: 
Reason: Reason: 
Relinquished Custody Accepted Custody Date and 
ime Time 
Signature: Signature: 
Printed Namc/Agency: 
Reason: Reason: 
Relinquished Custody Date and | Accepted Custody Date and 
Time Time 
Signature 
Printed Name/Agency: Printed Name/Agency: 
| Reason: Reason: 21 
| Relinquished Custody Date and | Accepted Custody Date and 
Time Time 
Signature: Signature: 
Printed Name/Agency: m ‘Name/Agency: 
Reason: Reason: 
Relinquished Custody Date and | Accepted Custody Date and 
Time Time 
Signature: Signature: 
Printed Name/Agency: | Printed Name/Agency: 
Reason: Reason: 
Relinquished Custody Date and | Accepted Custody Date and 
Time Time 
Signature: Signature: 
Printed Name/Agency: Printed Name/Agency: 
Reason: [ Reason: 
Relinquished Custody Date and | Accepted Custody Date and 
Time | Time 
Signature: | | Signature: 
Printed Name/Agency: Printed Name/Agency: 
Reason: | | Reason: 
Case ID: 288A-NK-2158180 iB: Barcode: 


This form is incomplete without reference to the FD-1987. 


288A-NK-2158180 Serial 11 


Е0-1057 (Rev. 5-8-10) 
UNCLASSIFIED 


FEDERAL BUREAU OF INVESTIGATION 


Electronic Communication 
Title: (U) Closing EC Date: 09/27/2017 


From: NEWARK 


L 1 be 


b7E 
Case ID d: 288A-NK-2158180 (U) JOHN MCAFEE; 
- VICTIM; 
COMPUTER INTRUSION - CRIMINAL = 
Synopsis: (U) To request that the captioned preliminary investigation 
be closed. 
Preliminary Investigation Initiated: 04/19/2017, set to expire 10/19 
/2017 
Details: 
CASE PREDICATION 
reported to FBI Newark an alleged computer intrusion and email account 
b6 
b7C 


UNCLASSIFIED 


288A-NK-2158180 Serial 11 


UNCLASSIFIED 


Title: (U) Closing EC 
Re: 288A-NK-2158180, 09/27/2017 


CASE OUTCOME 


On 04/19/2017, writer requested Computer Scientist (CS) 

Leo forensically image a laptop computer, a cellular phone 
device, and a tablet device belonging to Subsequently, logica 
l and file system extractions were successfully extracted from the 
cellular phone and tablet device. Thereafter, digital reports were 
generated for the case agent to review. Further analysis of the 
forensic images and reports did not indicate a computer intrusion nor 


the presence of any malware. 


UNCLASSIFIED 


2 


b6 
bIC 


b6 
ътс 


b6 
ътс 


b6 
ъ7с 


288A-NK-2158180 Serial 11 


UNCLASSIFIED 


Title: (U) Closing EC 
Re: 288A-NK-2158180, 09/27/2017 


ADMINISTRATIVE DETAILS 
All logical and reasonable investigation was conducted with regard 


to the investigation. 


All investigative methods/techniques initiated by Newark 
Division have been concluded and/or discontinued. 


All property and evidence has been returned to the owner or 
destroyed. 
No further investigation by Newark Division. It is requested 


that the case be closed with closing status C6: Other Closing (Ref 
DIOG 7.12.1). 


** 


UNCLASSIFIED 


3 


FEDERAL BUREAU OF INVESTIGATION 
FOL/PA 

DELETED PAGE INFORMATION SHEET 
FOL/PA# 1499961-000 


Total Deleted Page(s) = 23 
Page 5 ^ Duplicate; 
Page 6 ^ Duplicate; 
Page 7 ^ Duplicate; 
Page 8 ^ Duplicate; 
Page 9 ^ Duplicate; 
Page 10 ~ Duplicate; 
Page 11 ~ Duplicate; 
Page 12 ~ Duplicate; 
Page 14 ~ Duplicate; 
Page 15 ~ Duplicate; 
Page 16 ~ Duplicate; 
Page 17 ~ Duplicate; 
Page 18 ~ Duplicate; 
Page 19 ~ Duplicate; 
Page 20 ~ Duplicate; 
Page 21 ~ Duplicate; 
Page 22 ~ Duplicate; 
Page 23 ~ Duplicate; 
Page 25 ~ Duplicate; 
Page 28 ~ Duplicate; 
Page 31 ^ Duplicate; 
Page 32 ~ Duplicate; 
Page 33 ~ Duplicate; 


0000000000000000000000€ 
X Deleted Page(s) X 
X No Duplication Fee X 
X ForthisPage X 
ХХХХХХХХХХХХХХХХХХХХХХХХ 


1A/1C Rep 288A-NK-2158180 


IN IB Re JB x 


Acquired B Acquired O Serial # 
017-09-0; 
1017-05-04 
017-03-25 
017-05-0/ 


Serial Title Summary Attachmen Stored Loc: 
10 (U) FD-108 (U) FD-108 Digital and NONE 
2 (U) Report (0) Legal A Digital and NONE 
1 (U) COMPL (U) Intervie Digital NONE 
& (U) Forensi (U) Legal A Digital and NONE 


b6 
b7C 


C C 


FD-340c (4-11-03) 


File Number TRA-N Ke 2/8/89 — JAZ 

Field Office Acquiring Evidence _ MEIN ра 
Serial # of Originating Document 4. 
Date Received Mab us [og] 2 - 


From 
(Name of Contsibntor/interviewee) 
(Address) 
(City and State) 
By CJ 
ToBeRewmed Г] Yes D No 
ReceiptGiven [] Yes О No 
Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rules of Criminal Procedure 
O ve O No 
Federal Taxpayer Information (ЕТІ) 
D ves D No 
Title: 
Reference: 
(Communication Enclosing Material) 


Description: С Original notes re interview of 


Consent, Coos Ne) | Loy », CASU ess | 


b6 
ъ7с 


C : C 


TD-340c (4-11.03) 
File Number 285 Ar NE- 2375 Е - / AD 


Field Office Acquiring Evidence EDER 
Serial # of Originating Document Tp) 
Date Received oy у 6 |2. 2 


From А 
(Name of Contetbator/interviewee) 
(Address) 
ly and State) 
ToBeRetumed [1 Yes Пк 
ReceiptGiven [1 Yes П No 
Grand Jury Material - Disseminate Only Pursuant to Rule 6 (c) 
Federal Rules of Criminal Procedure 
D ves Li No 
Federal Taxpayer Information (ЕТІ) 
С ves O No 
Tile 
Reference: 
(Communication Enclosing Material) 


Descriptio: Original notes re interview of 


Courri, rir Com pote, CRES бары ___ 


b6 
bIC 


ES m = 
5 С Ж С. 


FD-340 (Rev, 4-11-03) 


File Number SEER АВ =} д Ч 
а 3 T Field Office Acquiring Evidence Nono, 


Serial # of Originating Document 9 


N 
H 


Date Received 1 
bé 
From BIC 
демесе) 
i | | 
i (Address) i 
У; 
- E (City and State) 
i b6 
m TA і By b7C 
To Be Retume: ©з m No 
Receipt Given Love M No 
Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 


Federal Rules of Criminal Procedure 


П we b No 
n 


Federal Taxpayer Information (FTI) 
Yes 


No 


Tide: 


Reference: . Ka BANN C an 


(Communication Enclosing Material 


Description: | E}-—oviginal netesteinterviewwof 


| EAR Ww E Kos QA ADO 163 А tn, 


FD-1004 FEDERAL BUREAU OF INVESTIGATION 
“Bev. 7-7-2016 EVIDENCE CHAIN OF CUSTODY 


Evidence Type: General Drugs Firearms/Weapon | Item 4 
Digital Valuables Firearms/Other 
Special Handling Instructions Initial Receipt Date and: 
Tim | bé 
HAZMAT Latents FGJ Signature of Seizing Individual m" 
Req. Charging Freeze Refrigerate | Printed Name/Agency: CS 6:00 pm 
Biohazard Reason: Initial Collection 
Other Collected By: CS| ь6 
Agency: FBI/ Newark P7C 
Relinquished Custody Date and | Accepted ; Date and 
Time T Time 
Signature; 175/17 Signature: Sr ъв 
Printed Name/Agency: FBI ya, ТЕ Printed N: g fü di b7C 
Reason: Z e аи » EN Eco Reason: am 
Relinquished Custody Date and | Accepted Custody” | Dateand 
Time Time 
Rue Signature] 4 fr 
556 Printed Name/Agency: ú b6 
Reason: cha DS BIC 
| Rélinquished Custody | Dateand | Accepted Custody | Dateand 
Time . Time- 
Signature: hl Signature: 

: ШҮЙ EE - 
Printed Name/Agency:| Printed Name/Agency: ыс 
Reason: Des WO ӨП | Reason: 

Relinquished Custody" | Date and | Accepted'Custody | Date and 
Time Time 

Signature: Signature: 

Printed Name/Agency: Printed Name/Agency: 

Reason: Reason: 

Relinquished Custody Date and | Accepted Custody , | Date and. 
Time’ Time 

Signature: Signature: 

Printed Name/Agency: Printed Name/Agency: 

Reason: Reason: 

Relinquished Custody ` Dateand | Accepted Custody Date’and 
Time i Time 

Signature: Signature: 

Printed Name/Agency: Printed Name/Agency: 

Reason: Reason: 

Firearm Certification by (Ғ1/6У/АТ) / Explosive Material Certification by (SABT): ATF Trace Form Completed: 

Printed Name: NCIC: 

Signature: 

Date: 

Case ID; 288A-NK-2158180 IB: { Barcode: 上 526 950 


This form is incomplete without reference to the FD-1087. 


EVIDENCE CHAIN OF CUSTODY 


ыы. 

Relinquished Custody Date and | Accepted Custody Date and 
Time Time 

Signature: Signature: 

Printed Name/Agency: Printed Name/Agency: 

Reason: Reason: 

Relinquished Custody Date and | Accepted Custody Date and 
Time Time 

Signature: Signature: 

Printed Name/Agency: Printed Name/Agency: 

Reason: Reason: 

Relinquished Custody Dateand | Accepted Custody Date and 
Time Time 

Signature: Signature: 

Printed Name/Agency: Printed Name/Agency: 

Reason: Reason: 

Relinguished Custody Date and | Accepted Custody Date and 
Time Time 

Signature: Signature: 

Printed Name/Agency: Printed Name/Agency: 

Reason: Reason: 

Relinquished Custody Date and | Accepted Custody Date and 
Time Time 

Signature: Signature: 

Printed Name/Agency: Printed Name/Agency: 

Reason: Reason: 

Relinquished Custody Dateand | Accepted Custody Date and 
Time Time 

Signature: Signature: 

Printed Name/Agency: Printed Name/Agency: 

Reason: Reason: 

Relinquished Custody Date and | Accepted Custody Date and 
Time Time 

Signature: Signature: 

Printed Name/Agency: Printed Name/Agency: 

Reason: Reason: 

Relinquished Custody Dateand | Accepted Custody Date and 
Time Time 

Signature: Signature: 

Printed Name/Agency: Printed Name/Agency: 

Reason: Reason: 

Relinguished Custody Date and | Accepted Custody Date and 
Time Time 

Signature: Signature: 

Printed Name/Agency: Printed Name/Agency: 

Reason: Reason: 

Relinquistied Custody Date and | Accepted Custody Date and 
Time Time 

Signature: Signature: 

Printed Name/Agency: Printed Name/Agency: 

Reason: Reason: 

Relinquished Custody Date and | Accepted Custody Date and 
Time Time 

Signature: Signature: 

Printed Name/Agency: Printed Name/Agency: 

Reason: Reason: 

Case ID: 288A-NK-2158180 IB: Barcode: 


This form is incomplete without reference to the FD-1087. 


FD-1004 
+ Rev, 7-7-2016 


FEDERAL BUREAU OF INVESTIGATION 
EVIDENCE CHAIN OF CUSTODY 


Evidence Type: General Drugs Firearms/Weapon | Item# 
Y Digital Valuables Firearms/Other 
Special Handling Instructions Initial Receipt Date and 
Time 
HAZMAT Latents FGI Signature of Seizing Individual 4/20/2017 
Req. Charging Freeze Refrigerate | Printed Name/Agency: CS 3:40 pm 
Biohazard Reason: Initial Collection 
Other Collected By: CS 
Agency; FBE/ Newark 
Relinquished Custody Date and | Accepted Custody Date and 
Time Time 
58/17 | Signature: 5j hir 
O qg pr Printed N FBE 
Reason: Be ly ap. сіз есе Reason: 5 (0де 10: ain 
Relinquished Custody Date and | Accepted Custody! Date and 
Time Time 


AS 


My 


55% 
123772 
Date and | Accepted Custody Date and 
Time Time 
Signature: 
pU Y ] | Printed Name/Agency: 
fosse] | Reason: 
Relinquished Custody Date and | Accepted Custody Date and 
Time Time 
Signature: Signature: 
Printed Name/Agenoy: Printed Name/Agency: 
Reason: Reason: 
Relinquished Custody Date and | Accepted Custody Date and 
Time Time 
Signature: Signature: 
Printed Name/Agency: Printed Name/Agency: 
Reason: Reason: 
Relinquished Custody Date and | Accepted Custody Date and 
Time Time 
Signature: Signature: 
Printed Name/Ageney: Printed Name/Agency: 
Reason: Reason: 


Firearm Certification by (FI/SWAT) / Explosive Material Certification by (SABT): 


Printed Name: 


NCIC: 


Signature: 


Date: 


ATF Trace Form Completed: 


Case ID; 288A-NK-2158180 


1B: en Barcode: E525 +5 il 


This form is incomplete without reference to the FD-1087. 


b6 
bIC 


b6 
b7C 


b6 
ъ7с 


b6 
юс 


EVIDENCE CHAIN OF CUSTODY 


Relinquished Custody 


Date and | Accepted Custody Date and 
Time Time 

Signature: Signature: 

Printed Name/A gency: Printed Name/Agency: 

Reason: Reason: 

Relinquished Custody Date and | Accepted Custody Date and 
Time Time 

Signature: Signature: 

Printed Name/Agency: Printed Name/Agency: 

Reason: Reason: 

Relinquished Custody Date and | Accepted Custody Date and 
Time Time 

Signature: Signature: 

Printed Name/Agency: Printed Name/Agency: 

Reason: Reason: 

Relinquished Custody Date and | Accepted Custody Date and 
Time Time 

Signature: Signature: 

Printed Name/Agency: Printed Name/Agency: 

Reason: Reason: 

Relinquished Custody Date and | Accepted Custody Date and 
Time Time 

Signature: Signature: 

Printed Name/Agency: Printed Name/Agency: 

Reason: Reason: 

Relinquished Custody Date and | Accepted Custody Date and 
Time Time 

Signature: Signature: 

Printed Name/Agency: Printed Name/Agency: 

Reason: Reason: 

Relinquished Custody Date and | Accepted Custody Date and 
Time Time 

Signature: Signature: 

Printed Name/Agency: Printed Name/Agency: 

Reason: Reason: 

Relinquished Custody Date and | Accepted Custody Date and 
Time Time 

Signature: Signature: 

Printed Name/Agency: Printed Name/Agency: 

Reason: Reason: 

Relinquished Custody Date and | Accepted Custody Date and 
Time Time 

Signature: Signature: 

Printed Name/Agency: Printed Name/Agency: 

Reason: Reason: 

Relinquished Custody Dateand | Accepted Custody Date and 
Time Time 

Signature: Signature: 

Printed Name/Agency: Printed Name/Agency: 

Reason: Reason: 

Relinquished Custody Dateand | Accepted Custody Date and | 
Time Time 

Signature: Signature: 

Printed Name/Agency: Printed Name/Agency: 

Reason: Reason: 

Case ID: 288A-NK-2158180 1B: Barcode: 


This form is incomplete without reference to the FD-1087. 


